A common step in deciding whether to grant a request for access to data or services in a network is to identify and authenticate the requesting user. Authentication includes the process of verifying the identity of a user. A known identification and authentication system includes associating a user identifier (“user id”) and a secret (“password”) for a user. The password can be a secret shared between the user and an authentication service. The user can submit his user id and password to the authentication service, which compares them with a user id and associated password that can be stored at the service. If they match, then the user is said to have been authenticated. If not, the user is said not to be authenticated.
A token is a device that can be used to authenticate a user. It can include one or more secrets, some of which can be shared with a validation center. For example, a token can store a secret key that can be used as the basis for calculating a One Time Password (OTP). A OTP can be a number (or alphanumeric string) that is generated once and then is not reused. The token can generate an OTP and send it along with a unique token serial number to an authentication server. The authentication server can calculate an OTP using its copy of the secret key for the token with the received serial number. If the OTPs match, then the user can be said to be authenticated. To further strengthen the link from the user to the token, the user can establish a secret Personal Identification Number (PIN) shared with the token that must be entered by the user to unlock the token. Alternatively, the PIN can be shared between the user, the token and the authentication server, and can be used with other factors to generate the OTP. A token typically implements tamper-resistant measures to protect the secrets from unauthorized disclosure.